Is Date of Birth PHI? Age, Dates and HIPAA Explained

It depends on how much of the date is kept and what it is linked to: a full date of birth, or an age over 89, is PHI when a HIPAA covered entity or its business associate holds it with information about a person's health, care or payment, because 45 CFR 164.514(b)(2)(i)(C) lists "All elements of dates (except year)" for dates tied to a person and "all ages over 89" as identifiers. A birth year alone, or an age of 89 or under, is not on that list, though in a patient's record it is still part of the PHI (45 CFR 160.103). Curve Compliance, which signs a BAA on every plan, lets clinics screen leads by age with date of birth rules in Curve Forms, and screened-out submissions send no conversion to ad platforms.

Book a call. Curve's team will review what your website sends to Meta, Google and TikTok with you, dates in forms and URLs included, then set up server-side conversions with PHI removed before anything is sent to an ad platform. Book a call with Curve.

Is age PHI? The rule on dates and ages

Item (C) of the Safe Harbor list in 45 CFR 164.514(b)(2)(i) reads in full: "All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older."

HHS says "Elements of dates that are not permitted for disclosure include the day, month, and any other information that is more specific than the year of an event," so "January 1, 2009" could appear in de-identified data only as "2009." For the oldest patients, "Ages that are explicitly stated, or implied, as over 89 years old must be recoded as 90 or above"; HHS's example turns a 1910 birth year into "on or before 1920" so no one can work out an age of about 100 (HHS).

An identifier is not PHI by itself. HHS says PHI "includes many common identifiers (e.g., name, address, birth date, Social Security Number) when they can be associated with the health information listed above" (HHS). Because the definition covers "demographic information collected from an individual" (45 CFR 160.103), any age in a patient's record is part of that record's PHI; the 89 cut-off only decides what may stay in de-identified data. See the 18 HIPAA identifiers, examples of PHI, and the spokes on phone numbers, email addresses and ZIP codes.

Appointment, admission and service dates

Item (C) names "admission date, discharge date, date of death," and a date of service is a date "directly related to an individual" in the rule's words (45 CFR 164.514). HHS says dates tied to lab tests "are directly related to a specific individual and relate to the provision of health care" (HHS). On websites, HHS lists "dates of appointments" among the information tracking technologies may collect (HHS).

Where dates and ages show up on a website and in ad data

Date or age	Where it shows up	Identifier under Safe Harbor?
Full date of birth	Intake and eligibility forms	Yes, item (C) (45 CFR 164.514).
Birth year only	A year-of-birth dropdown	No, unless it implies an age over 89 (HHS).
Age 89 or under	Age questions in quizzes and forms	No, though it is part of the PHI in a patient's record (45 CFR 160.103).
Age over 89	The same fields	Yes. It may be grouped as "age 90 or older" (45 CFR 164.514).
Appointment date	Booking widgets, confirmation pages and their URLs	Yes. HHS names "dates of appointments" (HHS).
Admission, discharge, service or test date	Patient portals, records and billing	Yes (HHS).
Date of birth as an ad match key	Meta's "db" parameter, marked "Hashing required."	Yes when it comes from a clinic's records. Meta lists "Date of Birth" among its customer information parameters (Meta).

HHS says regulated entities "are not permitted to use tracking technologies in a manner that would result in impermissible disclosures" of PHI to tracking vendors (HHS). As HHS notes on that page, a court vacated one part of the guidance on June 20, 2024, about IP addresses and visits to unauthenticated public pages; see what counts as PHI on a website.

Age in forms and ad data

Many clinics ask for a date of birth only to check eligibility. In a covered clinic's form, that date sits next to a request for care, so treat it as PHI from the moment it is typed, and ask only for what the form needs; see the minimum necessary rule. Ad platforms accept a date of birth as a hashed match key, and hashing does not take it out of HIPAA; see is a hashed email PHI. On Curve, contact identifiers are off by default on Meta, Google Ads and TikTok. Which rules apply to your forms depends on your facts, so talk to your counsel.

How Curve Compliance helps

Curve Forms hosts intake and lead forms under the BAA Curve signs on every plan. It can screen people out by age with date of birth rules, each with its own end screen, and screened-out submissions send no conversion to ad platforms, so the platforms learn from eligible leads. Form answers, a date of birth included, are never sent to an ad platform; form events reach Meta, Google Ads and your other destinations server-side through your event mappings.

Across the site, Curve Compliance replaces browser ad pixels with one script, sends each platform only a fixed list of fields, and checks every event for PHI-like patterns, stripping PHI before data reaches an ad platform. Event Logs show what Curve sent to each platform and what each platform accepted. Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week.

Sources, checked October 26, 2026: 45 CFR 164.514; 45 CFR 160.103; HHS, de-identification guidance; HHS, online tracking bulletin; HHS, 42 CFR Part 2 fact sheet; HHS, Security Rule NPRM; HHS, regulatory initiatives; Meta, customer information parameters.

Frequently Asked Questions

Is date of birth PHI?

A full date of birth is PHI when a HIPAA covered entity or business associate holds it with information about a person's health, care or payment, because "All elements of dates (except year)" tied to a person are on HIPAA's identifier list (45 CFR 164.514). A birth year alone is not, unless it implies an age over 89.

Is date of birth alone considered PHI?

Not necessarily. HHS says identifying information alone "would not necessarily be designated as PHI," and that PHI includes identifiers such as a birth date "when they can be associated with the health information listed above" (HHS). A birth date in a clinic's intake form sits next to a request for care, so it is PHI there.

Is age protected under HIPAA?

Ages over 89 are identifiers, so de-identified data must group them as 90 or older (45 CFR 164.514). Ages 89 and under are not on the Safe Harbor list, but any age in a patient's record is part of its PHI, because the definition covers "demographic information collected from an individual" (45 CFR 160.103).

What are the safe harbor identifiers under HIPAA?

The 18 items in 45 CFR 164.514(b)(2)(i): names; geographic units smaller than a state; dates tied to a person except year, and ages over 89; phone and fax numbers; email addresses; Social Security, medical record, health plan, account and license numbers; vehicle and device identifiers; URLs; IP addresses; biometrics; full face photos; and any other unique code. See the 18 HIPAA identifiers.

What is not considered PHI?

De-identified information, which "is not individually identifiable health information" (45 CFR 164.514(a)); FERPA education records, "employment records held by a covered entity in its role as employer," and records of a person "deceased for more than 50 years" (45 CFR 160.103); and aggregates that identify no one, such as HHS's average-age example (HHS).

What constitutes a PHI?

Under 45 CFR 160.103, PHI is "individually identifiable health information" in any form: information about a person's health, care or payment for care that "identifies the individual" or could reasonably be used to. HHS describes it as information "held or transmitted by a covered entity or its business associate" (HHS). See what counts as PHI on a website.

What is the new HIPAA rule in 2026?

There is no single new rule. Compliance with updated notice of privacy practices requirements and with the 42 CFR Part 2 rule was required by February 16, 2026 (HHS; HHS). The Security Rule update HHS issued on December 27, 2024 is still a proposed rule (HHS); see the new HIPAA rule in 2026.

Talk to Curve Compliance

Book a call. Curve Compliance sends your ad conversions server-side, screens form leads by age in Curve Forms and strips PHI before data reaches an ad platform, under the BAA it signs on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.